Balis 情報マガジン

phpinfophp

📅 October 29, 2026📖 Verified Publication
```html phpinfo.php – Complete Playbook for PHP Development & Server Diagnostics (2025)

phpinfo.php: The Ultimate Playbook for PHP Diagnostics, Security & Production Hardening

Everything senior developers and sysadmins need to know about one of PHP’s most powerful & most dangerous built-in functions.

Key Takeaways

  • phpinfo.php is a simple PHP script that calls phpinfo() to display the full current PHP configuration — version, extensions, server variables, environment, paths, and more.
  • It is invaluable for troubleshooting, verifying extension loads, and confirming INI settings, but exposes sensitive server data if left on a production server.
  • The single greatest risk is information disclosure: attackers can use phpinfo output to fingerprint PHP version, loaded modules, open_basedir paths, and disable functions.
  • Best practice: delete or restrict phpinfo.php immediately after debugging; never commit it to version control; use IP-whitelisting or move it behind auth when testing is needed.
  • Modern alternatives like php -i (CLI), php --ri for specific extensions, and dedicated diagnostic panels (e.g. php-fpm status) reduce the need for a web-accessible phpinfo page.

What Is phpinfo.php & Why Does It Exist?

The file phpinfo.php is not a PHP core component — it is a developer-created script that contains a single line:

<?php
phpinfo();
?>

When this script runs through a web server, PHP generates a massive HTML table covering every aspect of the runtime environment. It was originally designed as a first-step diagnostic tool for anyone setting up PHP, and it remains the fastest way to answer questions like:

  • Which PHP version is installed?
  • Are my required extensions loaded (PDO, GD, mbstring, intl)?
  • What are my memory limits, execution timeouts, and upload sizes?
  • Which .ini files are being parsed — and in what order?
  • What are the server API (SAPI) settings (FPM, Apache module, CLI, CGI)?
  • What environment variables and server globals are available?

For LAMP/LEMP stack deployments, a phpinfo page is often the very first test after installation — a quick visual confirmation that PHP is hooked into the web server correctly before any framework or application code runs.

How to Create a phpinfo.php File (Step-by-Step)

Prerequisites

  • A running web server (Apache, Nginx, Caddy) with PHP configured.
  • PHP installed and serving requests (verify with php -v).
  • Write access to your document root (commonly /var/www/html or public_html).

Step 1 — Create the File

# Linux / macOS
echo '<?php phpinfo(); ?>' > /var/www/html/phpinfo.php

# Windows (PowerShell)
'[System.Web.Configuration.HttpResponse]::New() | Out-Null; <?php phpinfo(); ?>' | Out-File -FilePath 'C:\inetpub\wwwroot\phpinfo.php' -Encoding ascii

Step 2 — Set Correct Permissions

  • Owner: www-data (Debian/Ubuntu) or nginx/apache (RHEL/CentOS)
  • Group: www-data
  • Mode: 640 (owner read/write, group read, others nothing)
sudo chown www-data:www-data /var/www/html/phpinfo.php
sudo chmod 640 /var/www/html/phpinfo.php

Step 3 — Access the Page

  • Open http://localhost/phpinfo.php or http://your-domain/phpinfo.php
  • You should see a paginated HTML report with colour-coded sections.

Step 4 — Verify & Delete

# After confirming your config, remove it immediately
rm /var/www/html/phpinfo.php

Reading phpinfo(): Every Section Explained

Understanding the output is as important as generating it. Below is a breakdown of every major section you will encounter, with the fields that matter most to developers and security engineers.

1. PHP Core

  • PHP Version: Major, minor, patch (e.g. 8.3.12). Check against the official support matrix — anything below 8.1 is end-of-life and should not run in production.
  • System: OS name and kernel version.
  • Server API: fpm/fcgid, apache2handler, cli, or cgi. Mismatched SAPI values between CLI and web can cause configuration surprises.
  • Virtual Directory Support: Should be disabled on modern setups.
  • Compatibility mode: Enable only during migration from PHP 7.x to 8.x.

2. Configuration (php.ini)

  • Loaded Configuration File: Path to the active php.ini. If empty, PHP falls back to a compiled-in default — dangerous for reproducibility.
  • Scan Directory: Additional .ini files parsed from this directory (e.g. /etc/php/8.3/fpm/conf.d/).
  • Additional .ini files: Merge order — later files override earlier ones.

3. Module / Extension Registry

Each loaded extension gets its own subsection. Key modules to verify:

  • pdo: Required for any database abstraction layer (Doctrine, Eloquent).
  • pdo_mysql / pdo_pgsql: Database driver for MySQL or PostgreSQL.
  • mbstring: Multibyte string support — non-negotiable for internationalised applications.
  • openssl: TLS/SSL support — critical for API calls and encryption.
  • curl: HTTP client capability.
  • gd or imagick: Image processing (check version — GD 2.3+ recommended).
  • intl: Unicode collation and formatting.
  • zip: Archive handling (Composer requires it).
  • json: Built-in since PHP 5.2 — should never be absent.
  • bcmath: Arbitrary precision math — needed for payment gateways.

4. Environment

  • Path: System $PATH available to PHP. Misconfigured paths can lead to passthrough() attacks via wildcard injection.
  • Server Variables